VSOL V2802RH teardown and full dump

[tantien11]

Soc: 9601D
Flash: 4MB
Optics: SC/UPC
Image:

Full dump:
v2802rh_full_dump.bin
Firmware update (V1.1.4):
v2802rh_v114.img
Env:

b0=setenv bootargs ${bootargs_base} ${mtdparts0} ${rst2dfl_flg}; bootm ${img0_kernel}
b1=setenv bootargs ${bootargs_base} ${mtdparts1} ${rst2dfl_flg}; bootm ${img1_kernel}
baudrate=115200
boot_by_commit=if itest.s ${sw_commit} == 0;then run set_act0;run b0;else run set_act1;run b1;fi
boot_by_tryactive=if itest.s ${sw_tryactive} == 0;then setenv sw_tryactive 2;setenv sw_active 0;saveenv;run en_wdt;run b0;else setenv sw_tryactive 2;setenv sw_active 1;saveenv;run en_wdt;run b1;fi
bootargs_base=console=ttyS0,115200
bootcmd=bootm 9fc27000
bootcmd_try_osk=bootm 9fc50000
bootcmd_try_osk_1M=bootm 9fd00000
bootcmd_try_osk_2M=bootm 9fe00000
bootcmd_try_osk_4M=bootm 94400000
bootcmd_try_osk_8M=bootm 94800000
bootdelay=3
en_wdt=mw b8003268 e7c00000
erase_cfgfs=sf erase ${fl_cfgfs} +${fl_cfgfs_sz}
erase_env=sf erase ${fl_env} +${fl_env_sz};sf erase ${fl_env2} +${fl_env_sz}
ethact=LUNA GMAC 
ethaddr=00:E0:4C:86:70:01
fl_boot_sz=21000
fl_cfgfs=44000
fl_cfgfs_sz=34000
fl_env=21000
fl_env2=23000
fl_env_sz=2000
fl_kernel1=78000
fl_kernel1_sz=140000
fl_kernel2=0
fl_kernel2_sz=0
fl_rootfs1=1b8000
fl_rootfs1_sz=248000
fl_rootfs2=0
fl_rootfs2_sz=0
fx1000_init=mw bb000084 00000048
img0_kernel=94078000
img1_kernel=94000000
ipaddr=192.168.1.3
mtdparts0=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0)ro,2336K(r0)ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,1280K@480K(linux),2336K@1760K(rootfs) root=31:5
mtdparts1=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0),2336K(r0),4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,0G@0G(linux),0G@0G(rootfs)
mupgrade_en=1
netmask=255.255.255.0
serverip=192.168.1.7
set_act0=if itest.s ${sw_active} != 0;then setenv sw_active 0;saveenv;fi
set_act1=if itest.s ${sw_active} != 1;then setenv sw_active 1;saveenv;fi
sgmii_init=mw bb000084 00000044
stderr=serial
stdin=serial
stdout=serial
sw_active=0
sw_commit=0
sw_tryactive=2
sw_valid0=1
sw_version0=V1.1.3
sw_version1=V1.1.3
tftp_base=80dc0000
up_osk=tftp 80000000 router.img;crc32 ${fileaddr} ${filesize};sf erase 27000 +${filesize};sf write ${fileaddr} 27000 ${filesize}
upb=tftp ${tftp_base} plr.img && crc32 ${fileaddr} ${filesize} && sf erase 0 +${fl_boot_sz} && sf write ${fileaddr} 0 ${filesize}
upb_osk=tftp 80000000 plr.img;crc32 ${fileaddr} ${filesize};sf erase 0 +${filesize};sf write ${fileaddr} 0 ${filesize}
upe=tftp ${tftp_base} uboot-env-98d-eng.bin && sf erase ${fl_env} +${fl_env_sz} && sf write ${fileaddr} ${fl_env} ${fl_env_sz} && sf erase ${fl_env2} +${fl_env_sz} && sf write ${fileaddr} ${fl_env2} ${fl_env_sz}
upk=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write ${fileaddr} ${fl_kernel1} ${filesize}
upk1=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel2} +${fl_kernel2_sz} && sf write ${fileaddr} ${fl_kernel2} ${filesize}
upr=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write ${fileaddr} ${fl_rootfs1} ${filesize}
upr1=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs2} +${fl_rootfs2_sz} && sf write ${fileaddr} ${fl_rootfs2} ${filesize}
upt=tftp 80000000 img.tar && upimgtar ${fileaddr} ${filesize}
upv=tftp 80000000 vm.img;upvmimg ${fileaddr}
yk=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write 80000000 ${fl_kernel1} ${filesize}
yr=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write 80000000 ${fl_rootfs1} ${filesize}
yu=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase 0 +${fl_boot_sz} && sf write 80000000 0 ${filesize}

Environment size: 3970/8187 bytes\

[Anime4000]

this ONU bootloader is not encrypted right? it just same as ODI stick?

[richardkendi]

Does either of you two have firmware version V2802RH_V1.1.4_230628_ S632.img ????

https://www.right.com.cn/forum/thread-8298193-1-1.html

firmware for official support

https://share-b2820b2e832b1cfca838c8e60a7bd62d.fangcloud.cn/share/9e6881484ead2a6c0e18df4352

[SpeedxThunder001]

latest firmware is 1.1.5

https://drive.google.com/file/d/1ya9ELxmpwkXk1Aajw9rZ144Hea947kci/view?usp=sharing

[richardkendi]

hey, would you have version 1.1.6 to make available? looks like it came out

[SpeedxThunder001]

no i don't have that firmware

[richardkendi]

latest firmware is 1.1.5

https://drive.google.com/file/d/1ya9ELxmpwkXk1Aajw9rZ144Hea947kci/view?usp=sharing

safe?
how to confirm if it's true?

[SpeedxThunder001]

my one came with the same firmware

and i got it direct from vsol engineer

here is the skype contact live:.cid.821242afac75373f

[tithitoy]

May you get SHA=256 from Vsol engineer for confirming. Thanks

[SpeedxThunder001]

068af57bfe44cfcdffcdbbed191c6a76c7817cab8a9eb9c52b567888db91bc1a

[SpeedxThunder001]

also you can get it customized with either APC or UPC if purchased directly from VSOL

[richardkendi]

also you can get it customized with either APC or UPC if purchased directly from VSOL

Cool
she didn't know. I thought it could only be UPC, here in Brazil it's all APC.
mine is like UPC and I had to convert.

[Elkowak]

Soc: 9601D Flash: 4MB Optics: SC/UPC Image: Full dump: v2802rh_full_dump.bin Firmware update (V1.1.4): v2802rh_v114.img Env:

I used your dump to fix my bricked V2802rh, did you changed the admin password? stdONUi0 pass is not working

Edit: already tried reset button, but seems not working 😢

[richardkendi]

A senha é stdONUi0i faltou um " i " aí kkk

[SpeedxThunder001]

how did you fix it?

can you share the steps?

[Elkowak]

you will need a spi programmer and soic8/sop8 adapter i used a ch341 and generic adapter from aliexpress

[SpeedxThunder001]

my current situation is that even if I reset it's getting reset to my manual config and whenever I am trying to update the firmware or upload the config it throws a file format error

this is the console output whenever I am trying to update
https://justpaste.it/7jlo8

can you help me with it?

[chundz]

Soc: 9601D Flash: 4MB Optics: SC/UPC Image: Full dump: v2802rh_full_dump.bin Firmware update (V1.1.4): v2802rh_v114.img Env:

b0=setenv bootargs ${bootargs_base} ${mtdparts0} ${rst2dfl_flg}; bootm ${img0_kernel}
b1=setenv bootargs ${bootargs_base} ${mtdparts1} ${rst2dfl_flg}; bootm ${img1_kernel}
baudrate=115200
boot_by_commit=if itest.s ${sw_commit} == 0;then run set_act0;run b0;else run set_act1;run b1;fi
boot_by_tryactive=if itest.s ${sw_tryactive} == 0;then setenv sw_tryactive 2;setenv sw_active 0;saveenv;run en_wdt;run b0;else setenv sw_tryactive 2;setenv sw_active 1;saveenv;run en_wdt;run b1;fi
bootargs_base=console=ttyS0,115200
bootcmd=bootm 9fc27000
bootcmd_try_osk=bootm 9fc50000
bootcmd_try_osk_1M=bootm 9fd00000
bootcmd_try_osk_2M=bootm 9fe00000
bootcmd_try_osk_4M=bootm 94400000
bootcmd_try_osk_8M=bootm 94800000
bootdelay=3
en_wdt=mw b8003268 e7c00000
erase_cfgfs=sf erase ${fl_cfgfs} +${fl_cfgfs_sz}
erase_env=sf erase ${fl_env} +${fl_env_sz};sf erase ${fl_env2} +${fl_env_sz}
ethact=LUNA GMAC 
ethaddr=00:E0:4C:86:70:01
fl_boot_sz=21000
fl_cfgfs=44000
fl_cfgfs_sz=34000
fl_env=21000
fl_env2=23000
fl_env_sz=2000
fl_kernel1=78000
fl_kernel1_sz=140000
fl_kernel2=0
fl_kernel2_sz=0
fl_rootfs1=1b8000
fl_rootfs1_sz=248000
fl_rootfs2=0
fl_rootfs2_sz=0
fx1000_init=mw bb000084 00000048
img0_kernel=94078000
img1_kernel=94000000
ipaddr=192.168.1.3
mtdparts0=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0)ro,2336K(r0)ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,1280K@480K(linux),2336K@1760K(rootfs) root=31:5
mtdparts1=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0),2336K(r0),4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,0G@0G(linux),0G@0G(rootfs)
mupgrade_en=1
netmask=255.255.255.0
serverip=192.168.1.7
set_act0=if itest.s ${sw_active} != 0;then setenv sw_active 0;saveenv;fi
set_act1=if itest.s ${sw_active} != 1;then setenv sw_active 1;saveenv;fi
sgmii_init=mw bb000084 00000044
stderr=serial
stdin=serial
stdout=serial
sw_active=0
sw_commit=0
sw_tryactive=2
sw_valid0=1
sw_version0=V1.1.3
sw_version1=V1.1.3
tftp_base=80dc0000
up_osk=tftp 80000000 router.img;crc32 ${fileaddr} ${filesize};sf erase 27000 +${filesize};sf write ${fileaddr} 27000 ${filesize}
upb=tftp ${tftp_base} plr.img && crc32 ${fileaddr} ${filesize} && sf erase 0 +${fl_boot_sz} && sf write ${fileaddr} 0 ${filesize}
upb_osk=tftp 80000000 plr.img;crc32 ${fileaddr} ${filesize};sf erase 0 +${filesize};sf write ${fileaddr} 0 ${filesize}
upe=tftp ${tftp_base} uboot-env-98d-eng.bin && sf erase ${fl_env} +${fl_env_sz} && sf write ${fileaddr} ${fl_env} ${fl_env_sz} && sf erase ${fl_env2} +${fl_env_sz} && sf write ${fileaddr} ${fl_env2} ${fl_env_sz}
upk=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write ${fileaddr} ${fl_kernel1} ${filesize}
upk1=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel2} +${fl_kernel2_sz} && sf write ${fileaddr} ${fl_kernel2} ${filesize}
upr=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write ${fileaddr} ${fl_rootfs1} ${filesize}
upr1=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs2} +${fl_rootfs2_sz} && sf write ${fileaddr} ${fl_rootfs2} ${filesize}
upt=tftp 80000000 img.tar && upimgtar ${fileaddr} ${filesize}
upv=tftp 80000000 vm.img;upvmimg ${fileaddr}
yk=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write 80000000 ${fl_kernel1} ${filesize}
yr=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write 80000000 ${fl_rootfs1} ${filesize}
yu=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase 0 +${fl_boot_sz} && sf write 80000000 0 ${filesize}

Environment size: 3970/8187 bytes\

Thank for your contribution
Cám ơn Tiến !

[chundz]

Hi Everyone!
I got new firmware from Vsol Engineering Team
V2802RH V1.1.6

SHA256 - da4107febb6e50e8b249cbdbf8e229dc65f98264634df6d5ece70b645004e0aa

https://drive.google.com/file/d/1l1kiHp6oQaVgvDK8QAwHJ_URjmU0xGFY/view?usp=drivesdk

[alvinv331]

Is it possible modify it to use at Unifi Msia?
TQ

[richardkendikaku]

custom firmware for vsol v2802RH.

tripleoxygen.net/wiki/ont/vsol/v2802rh

changelog.

1.9.2
Alterado tamanho máximo do campo HW_HWVER/HW version para 18 caracteres (via telnet ou serial; pela GUI Web o máximo são 14 caracteres).
V2802RH_V1.9.2.img (Build date: 03/09/2023 | SHA256: 8a1c432223a6237616d10aea9926b028a34c240ed6fffc4cc9e59e8b401a6111)

1.9.1
Removido validação do MAC pela chave de autorização. Qualquer MAC (ELAN_MAC_ADDR) pode ser utilizado agora.
Baseada no release oficial V1.1.6
V2802RH_V1.9.1.img (Build date: 01/09/2023 | SHA256: f0f56fcc7be1643a45cd3be59e65b276321a3a5c69f9d14619256050834974b5)

[d5aqoep]

Anyone has the latest 1.1.7 firmware?

[viniciuspaes]

https://viniciuspaes.com/redes/tutorial-substituir-modem-fibra-ftth-modem-vsol-v2802rh/#firmware

[topsbr]

Why can't I reset this sh** to default?
I'm using the latest official version and none of the passwords, neither the default nor the one I set, work...
Any ideas or throw away this crap?

[djordjeradovic]

Can anyone confirm what is the actual maximum speed that can be achieved over the 2.5GbE port? Is it at least above 2000 Mbps?

[Anime4000]

I tried once, it can reached 2041Mbps, but quickly drop to 1.7Gbps due to overheat

[djordjeradovic]

That's great to hear! I have ordered one today and will add heatsinks to it as soon as it arrives. If it can sustain 2000 Mbps that's solid performance for me.

[Anime4000]

try that, the VSOL V2802RH only can bridge VLAN PPPoE, but cannot bridge other VLAN such as VoIP.

[djordjeradovic]

I don't need VoIP, only need internet WAN with dynamic IP bridged to 2.5GbE port. No routing or anythin else, I use pfSense for that.

[dudu15051505]

I was able to use VoIP with this ONU.

In my case with my ISP, I gave vlan tag 100 on the lan2 2.5Gb port for pppoe internet, and vlan tag 200 on the lan1 1Gb port for ipoe voip.

The ideal would be to pass vlan trunk to the lan ports and configure directly in pfsense, but I was unable to configure this mode, and I ended up in this compromise using 2 nics.

[gpborges]

Could anyone post detailed instructions on how to flash a firmware in a VSOL which is bricked after a firmware update? All LEDs seams to be working fine (as per their manual), but I can't get it to assign an IP and hence, can't logon neither via web nor telnet.

Thanks!

[d5aqoep]

Reset your VSOL, assign IP 192.168.1.2 to your PC, Subnet Mask 255.255.255.0 and default gateway as 192.168.1.1

Then login to 192.168.1.1 with username admin and password stdONUi0i

[hvthang25399]

Hi Tien,
Shared files are not yet public. Can you add permission for my email: hvthang1231@gmail.com

[djordjeradovic]

Hi everyone!

I received my VSOL V2802RH today and I started playing with it. But I have a problem connecting by telnet. I have no problem logging into the WebUI. I can see in Advanced -> Other that Telnet is enabled (I have tried disabling and re-enabling but it's still not working). I have tried using both LAN ports on the ONT but I just can't connect. I have tried both via windows CMD and via MobaXterm. Does anyone know what the issue might be?

[djordjeradovic]

The issue is that I can't change the serial number via the WebUI.

[djordjeradovic]

I have resolved the issue. You need to add telnet to the ACL in Firewall settings.

[dudu15051505]

Does anyone know how to configure vlan trunk mode on this ONU?

In the datasheet it says that it supports this mode for up to 8 vlans, but on the configuration web page it is simply not explained and much less intuitive how to configure this mode.

https://www.vsolcn.com/wp-content/uploads/2023/03/XPON-ONT-V2802RH-Datasheet-V1.0-EN-3.pdf

[richardkendikaku]

How do I reset this shit if the reset button doesn't work? I no longer have access to the home screen

[Anime4000]

you need access via UART if reset button doesn't work

[richardkendikaku]

as?
I connected it here via serial but it still doesn't connect via putty on the com4 port....

[forzic]

Good evening, where do you get the vsol firmware from?

[viniciuspaes]

You can get through support team in their website.

[collerok]

https://www.123pan.com/s/QGtA-GJCyh.html

[techtito]

Its possible to use this VSOL firmware on ODI DFP-34X-2C2 ?
https://viniciuspaes.com/wp-content/uploads/2023/05/V2802RH_V1.9.2_CFW.img

[viniciuspaes]

no

[richardkendikaku]

hello, Follows version 1.1.8 sent by vsol devs. They sent me another link but this link is temporary so I uploaded it to my cloud and shared it

https://v2.fangcloud.com/share/15dd8b8dae8451b25a126de7b4

https://drive.google.com/file/d/1pu6bVRiDYZEUSVHhJQlRn0owyLlE8xGW/view?usp=drivesdk

[umf137]

Anyone got this flash dump? I accidentally brick my converter

[normtomlins]

They also have these for SC/APC (green) now as well

[longthanhtran]

I left my v2802rh for a few weeks and now seems I can't use its lan2 (2.5Gb) (led still light up with cable plugged in). LAN ACL checked but I can't see any issue as I open connection from LAN subnet (same setting as usual) so maybe the LAN port no longer work.
Anyway, I try a latest custom fw from tripleoxygen, and it works for my case.

[Yazeed-Momani]

After updating my V2802RH to firmware V1.1.8, it keeps rebooting right after the PON LED turns solid green. It’s stuck in this loop. I managed to fix it by disconnecting the fiber cable, then it booted normally. I had to roll it back to V1.9.4 by O3labs. Has anyone else experienced this?

[longthanhtran]

Probably your ISP sends settings / updates via omci which cause reboot loop due to incompatability. In this case, the viable option is to roll back to working fw version (1.1.7?)

[Yazeed-Momani]

Okay, but why does 1.1.7 work fine? Actually, the stock 1.1.7 didn't work because of the HW_HWVER/HW version limitation, but still, 1.9.4 works just fine! Are you saying that 1.1.7 can handle some ISP requests that 1.1.8 can't?

[longthanhtran]

I'm not your ISP, not your sfp manufacture, not fw author and I made the best guest with version number, 1.1.7 with a question mark. That's a suggestion to try with the last working version of fw on your ISP infrastrure. Any working fw is good enough.

[normtomlins]

Customized OLT Mode (Nokia), and by the way, I also have tried 1.A.1 and 1.A.2 by O3labs and had the same issue. Both of these custom versions are built based on 1.1.8

We are currently using ZTE C320 without any issues. However, reprograming each unit and uploading a new default configuration is a pain. I contacted O3labs to see if they wanted to do custom firmware, but they declined.

[Yazeed-Momani]

No worries, I get the amount of work needed to build custom firmware. My V2802RH works really well with 1.9.4, and I'm getting amazing speeds compared to my ISP-provided bridge. I was just curious if anyone else had the same experience and how they solved it, but I'm happy with 1.9.4.